by Kastro CVE-2026-44990
apostrophecms sanitize-html — Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Description · from the CVE record
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Affected
ProductAffectedFixed inSource
sanitize-html< 2.17.4–CNA
multicluster engine for Kubernetes 2.1see advisory1784312384redhat-SADP
multicluster engine for Kubernetes 2.11see advisory1786911977redhat-SADP
multicluster engine for Kubernetes 2.17see advisory1786668856redhat-SADP
multicluster engine for Kubernetes 2.6see advisory1783351002redhat-SADP
multicluster engine for Kubernetes 2.8see advisory1785078604redhat-SADP
multicluster engine for Kubernetes 2.9see advisory1783348181redhat-SADP
Red Hat Advanced Cluster Management for Kubernetes 2.11see advisory1783350952redhat-SADP
Red Hat Advanced Cluster Management for Kubernetes 2.13see advisory1785078581redhat-SADP
Red Hat Advanced Cluster Management for Kubernetes 2.14see advisory1783451729redhat-SADP
Red Hat Advanced Cluster Management for Kubernetes 2.15see advisory1784578812redhat-SADP
Red Hat Advanced Cluster Management for Kubernetes 2.16see advisory1786908361redhat-SADP
Scores by source
GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
redhat-SADP (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total